Managed disks do not use a specific set of disk encryption sets for customer-managed key encryption

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_93
Category - Subcategory	Storage - Encryption
Provider	AZURE
Severity	LOW
Framework	ARM, Bicep, Terraform, Terraform Plan

Impact

Requiring a specific set of disk encryption sets to be used with managed disks give you control over the keys used for encryption at rest. You are able to select the allowed encrypted sets and all others are rejected when attached to a disk.

How to Fix

Resource: azurerm_managed_disk

• Arguments: disk_encryption_set_id [source,go]

---

resource "azurerm_managed_disk" "source" { name = "acctestmd1" location = "West US 2" resource_group_name = azurerm_resource_group.example.name storage_account_type = "Standard_LRS" create_option = "Empty" disk_size_gb = "1"

• disk_encryption_set_id = "koko" tags = { environment = "staging" } }

---